🔐 JWT Decoder
Inspect JSON Web Token header and payload claims locally, including the expiration timestamp.
Inspect a JSON Web Token
Paste a three-part JWT to decode its header and payload locally. Decoding does not verify the signature or authenticity.
Never paste a production secret into a device or browser you do not trust.
How It Works
JWT data = Base64URL-decode(header) + Base64URL-decode(payload)A JWT has header, payload, and signature segments. This tool decodes the first two segments but does not verify the signature. Processing runs locally in your browser.
Worked Example
Paste a three-part JWT to view formatted header and payload JSON plus its expiration state.
Frequently Asked Questions
How should I use this tool?
Decoding reveals claims but does not prove a token is authentic. Signature verification requires the correct trusted key.
Does Calcixa upload my file or token?
No. Inputs and results remain in your browser and are not sent to a Calcixa server.
CALCIXA PRACTICAL GUIDE
How to use the JWT Decoder
The JWT decoder displays the header and payload of a JSON Web Token without sending it to Calcixa. Decoding Base64url sections helps inspect claims, but it does not verify the signature, issuer, audience, revocation status, or trustworthiness.
JWTs can contain account data and active credentials. Avoid pasting production tokens on shared devices, and never treat readable claims as authentic until a trusted application validates the signature and all required claims.
Step-by-step
- Use a non-sensitive or redacted token whenever possible.
- Paste the compact JWT and decode its sections.
- Inspect algorithm, issuer, audience, subject, and time claims.
- Perform cryptographic verification in the application using trusted keys and strict validation rules.
How to read the result
- Header and payload are decoded representations and can be altered by anyone.
- exp, nbf, and iat commonly contain NumericDate values.
- A third signature section does not mean the signature has been validated.
Common mistakes to avoid
- Believing decoded claims without signature verification.
- Exposing a bearer token through clipboard history or screenshots.
- Accepting an unexpected algorithm, issuer, or audience.
Important: Review important outputs before relying on them in a production, legal, or safety-critical workflow.
More questions about JWT Decoder
Does this verify JWT signatures?
No. It decodes sections only and clearly must not be used as authentication verification.
Why is the payload readable?
JWT payloads are encoded, not encrypted, unless a separate encrypted-token format is used.
Can I share a decoded token?
Do not share active tokens or sensitive claims; they may grant access or expose personal data.
Sources and methodology
Calcixa explains the model, assumptions, and limitations so you can verify the result. See our calculation and tool methodology for rounding, privacy, testing, and correction practices.
Maintained by the Calcixa product team. This page was last updated on 7 September 2026.